Hello,
Kaushik found a problem while verifying https://bugzilla.redhat.com/show_bug.cgi?id=1170910 . The root of the problem was that we were denying access for user of which at least one group failed to be resolved. This is too strict and can be relaxed to denying access only if the simple_deny_groups is not empty at the same time.
Please see attached patch.
Thanks!